On October 26, 2026, the Bank of England and the Financial Conduct Authority published their fourth survey of AI in UK financial services. The sample is not the whole sector. One hundred ninety-six firms responded. Smaller firms could take a short form. Unless the report says otherwise, the figures come from the 105 firms that completed the full survey, so they can be compared with earlier rounds. The authors say differences in who answered, and in how questions were worded, mean the 2026 and 2024 percentages should be read with care.
Within those limits, the adoption line is steep. Across full and short forms, 86 percent of respondents said they use AI, compared with 75 percent in the 2024 survey and 58 percent in 2022. Every responding UK bank and international bank said it uses AI. Generative systems accounted for 56 percent of reported AI systems. In 2024, foundation models, including large language models, accounted for 17 percent of reported use cases. The report says those two cuts are not the same measure, and still reads them as a real shift toward general-purpose tools.
The controls are front-loaded
Governance paperwork is in place. Ninety-four percent of respondents reported firmwide AI policies, principles, or standards. Eighty-four percent reported a central AI or model-risk forum. Human approval, pre-deployment review, and vendor due diligence were each reported by more than 90 percent. Ongoing monitoring, leakage testing, and periodic review or recertification were each reported by around half.
That gap is the operating story. A policy and a launch review answer the question a project committee asks. Leakage testing and recertification answer the question a model asks after a vendor ships an update on a Tuesday. The second question is where the survey is thinner.
Third parties hold the material systems
Third-party implementations were 39 percent of reported AI systems, up from 33 percent in 2024, and 53 percent of high-materiality systems, up from 35 percent. For high-materiality systems built in house, 77 percent of respondents relied on deep knowledge of the system. For third-party systems, 24 percent said they had that depth. Eighty-one percent relied instead on vendor assurance and contracts.
Cloud and compute relationships are concentrated: the top three providers accounted for 79 percent of reported relationships. The top three model or API providers accounted for 54 percent. Information security and operational resilience were a major constraint on third-party adoption for 40 percent of respondents. Limited transparency into third-party systems followed, at 34 percent.
A smaller slice of the questionnaire, 48 firms, answered a question about high-materiality vendor updates. The Bank says those results should be treated with caution. Within that slice, 25 percent said they always or usually allow high-materiality vendor updates to propagate into production automatically. Forty-eight percent said they always regression-test such updates, and another 25 percent usually do. Seventy-three percent always or usually have a rollback plan.
What the supervisor calls good practice
The FCA’s October 2026 note on good and poor practice does not invent a new AI rulebook. It says firms can outsource the service and still own the outcome. The practices it praises are concrete: more than one provider so a single vendor cannot strand the firm, an inventory that separates experiments from production, contractual notice of significant model changes, and a tested exit. The failures it names match the survey: untested vendor assurances, hard-to-replace providers, and no fallback.
Agents are already inside this perimeter, with the autonomy dial turned down. Eighty percent of respondents had AI agents in production that recommend actions while humans decide and execute. A further reading of the same survey says 80 percent have agents deployed and 14 percent plan to deploy within a year, while only 2 percent report agents with broad autonomy. Even including plans, no more than 9 percent expected agents to approve or decline customer outcomes, place trades, move payments, or change limits. The control problem of 2026 is less “the model will wire the money” and more “the firm cannot see the model that drafts the recommendation.”
About 7 percent of reported systems were judged high materiality, down from 16 percent in 2024, though the absolute count of high-materiality systems rose. Almost half of firms reported ten or fewer systems. The top ten respondents accounted for 43 percent of all reported systems. A sector average will hide a handful of firms that are already running a large estate, and a long tail that is still on productivity tools. Enterprise productivity — coding assistants, summarization — was the most common current use, selected by 86 percent.
For a risk committee outside the United Kingdom, the transferable question is the same one the FCA writes down. At the moment a vendor changes a high-materiality tool, who is notified, who retests, and who can roll it back? If the honest answer is the contract, the survey says that is the common answer, and the supervisor has already marked it as a place to improve.